CVE-2020-12888: canonical ubuntu_linux
Vulnerability summary
CVE-2020-12888 is a medium (CVSS 5.3) vulnerability in canonical ubuntu_linux. EPSS estimates a 0.40% chance of exploitation in the next 30 days, higher than 34.6% of scored vulnerabilities.
Not severe (CVSS 5.3, local access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 28 · Related 17Timeline
- 15-05-2020PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
The VFIO PCI driver in the Linux kernel through 5.6.13 mishandles attempts to access disabled memory space.
CVSS metrics
5 scores · 4 sources · 2 versions- OSV · Red hatEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:N/I:N/A:H
- OSV · UbuntuEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:N/I:N/A:H
EPSS trend
Probability
0.40%
Chance of exploitation in the next 30 days
Percentile
35%
Versus all other CVEs
30-day change
No change 0.00 pp
From 0.40% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Known conditions: local access, administrative account, no user interaction (CVSS vector). Other conditions: not stated in public data.
Redhat43 products
- bpftool< 0:3.10.0-1127.13.1.el7
- bpftool-debuginfo< 0:3.10.0-1127.13.1.el7
- kernel< 0:3.10.0-1127.13.1.el7 | < 0:3.10.0-327.89.1.el7
- kernel-abi-whitelists< 0:3.10.0-1127.13.1.el7 | < 0:3.10.0-327.89.1.el7
- kernel-bootwrapper< 0:3.10.0-1127.13.1.el7
Ubuntu41 products
- linuxAll versions (No fix recorded) | < 4.4.0-223.256 | < 4.15.0-118.119 | < 5.4.0-48.52
- linux-aws< 4.4.0-1103.108 | < 4.4.0-1139.153 | < 4.15.0-1083.87 | < 5.4.0-1025.25
- linux-aws-5.0All versions (No fix recorded)
- linux-aws-5.3All versions (No fix recorded)
- linux-aws-5.4< 5.4.0-1025.25~18.04.1
Netapp20 products
Debian2 products
- linux< 5.8.7-1
- debian_linuxEOL9.0
Canonical1 product
- ubuntu_linuxEOL14.04 | 16.04 | 18.04 | 20.04
Fedoraproject1 product
- fedoraEOL31 | 32
Linux1 product
- linux_kernel≤ 5.6.13
Opensuse1 product
- leapEOL15.1 | 15.2
8 vendors · 110 products
References
32 links- www.openwall.com/lists/oss-security/2020/05/19/6Mailing ListX Refsource MLISTREPORTThird Party Advisory
- lists.opensuse.org/opensuse-security-announce/2020-07/msg00008.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
- lists.opensuse.org/opensuse-security-announce/2020-08/msg00009.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
Show all 32 references
lists.debian.org/debian-lts-announce/2020/09/msg00025.htmlMailing ListX Refsource MLISTThird Party Advisory- lists.debian.org/debian-lts-announce/2020/10/msg00032.htmlMailing ListX Refsource MLISTThird Party Advisory
- lists.debian.org/debian-lts-announce/2020/10/msg00034.htmlMailing ListX Refsource MLISTThird Party Advisory
